FortiOS v5.2.4 is out(Unstable GUI, Bad SSLVPN)....

BrUz wrote:

I completely agree that there is a difference between these. But, my point is that these actually deliver good solutions that work... It is not silly to compare, I encounter these questions from my clients all the time! Especially all those self-created problems Fortinet creates by them self..  It's terribly bad of a large "professional" supplier that Fortinet want to be. 

 

When there is so much trouble there is a huge problem. And we should expect that things work better.. We have to defend Fortinet with tooth and nail every single day! Outside these issues, I personally love Fortinet Hardware/FortiOS, and want it to be the best!.

Here, here.  Even with all of the frustration we are experiencing, I'd still take Fortinet over all due the performance/features/price as compared to everyone else.  But that doesn't mean I won't consider a more stable or capable solution if I find it.  I never stop looking.  I'm loyal but not devout :)

I once had a Cisco team in my office before the Sourcefire purchase, and I asked them why the ASA still didn't have AV capability.  Their response was that they didn't think AV was important at the gateway.  I almost laughed them out of the office.  I've never had a major breach or malware infection in 8 years and AV on the Fortinet is one of the key reasons in my opinion.

Paul S wrote:

Not all, but many of the upgrades since then have left me with the post update dilemma that I am sadly getting used to: do I live with major bug X in the new release or downgrade back to living with major bug Y?  I try to weigh risks and choose the one that impacts me the least, but often the choices are horrible.

Exactly. We've internally discussed (but not yet built) a reference sheet for working features. I have a number of diffeent customers, each with specific needs and pain points. Customer X might need SSLVPN, but would also like a few of the features in the 5.2 code, while Customer Y is using Radius, and Customer Z needs to have a read-only admin account for some auditing purposes.

Normally, I would like to just pick one firmware version and stick with it. But inevitably something seems to be amiss in any given release. 5.2.4 is SSLVPN and etc, 5.2.2 was the all service bug (fixable), 5.0.9-11(?) allowed a read only admin to make changes. 

BrUz wrote:

+ Google Chrome is unstable on all devices running 5.2.4.

You are likely running into this Google Chrome issue that causes certificate exemptions to be reset:-

https://code.google.com/p/chromium/issues/detail?id=513903

https://code.google.com/p/chromium/issues/detail?id=473390

It is not a FortiOS bug. Using a trusted certificate would solve the problem.

Zulhardy wrote:

Another thing I'd like to add.

 

When I upgraded to 5.2.4, I noticed that about 20 WIFI clients were logged onto a single FortiAP 221B. I have five of them around the office where I work at and usually the clients are dispersed among the APs. After downgrading as per TAC advice (for another issue I posted above), the APs then started load balancing them and the usual client dispersal pattern was seen once again.

 

I think so far 5.2.3 is the most stable for me 100D and my FortiAP 221Bs. 

I have similar problems. FAP21B take all users and working fine.. But, no users are able to connect through local radio in fwf90d. 

SecurityPlus wrote:
If Fortinet discovers an error in a release (i.e. 5.2.4) will they patch the 5.2.4 release or do they wait till the next release (i.e. 5.2.5) to apply the patch?   Are some finding the 5.2.4 release to be problem free or are the problems more widespread?   Thanks!

emnoc wrote:

or foolish enough

 

Typically I wait at least 2 months b4 loading my gear on the wagon, that way you let others cross the water b4 you . This way if they have problems & drown, you can stay on the banks and be safe.

 

Never run the latetest in a production env until you had time to evaluate and demo the code.

I agree.  But then you'll still be evaluating v5.2.5 when your v5.0 production boxes go out of support in November.

Fortinet's aggressive software product life cycle policy, combined with their lack of decent QA on new releases, has more negative impact on their loyal customer base than I think they realise.

ISOffice wrote:

We also have upgraded to v5.2.4 (build 688) on our FG 100D cluster. Whilst not having experienced any major faults with it (other than the slightly annoying failure to display the right pane on occasion), the amount of posts here complaining about it does give me cause for concern and I'm thinking of rolling back to v5.2.3 (build 670).

Therefore I'm asking if the following is an acceptable way to downgrade to a previous version.

In the System Information widget, under Firmware Version, select Update.

Under Available Firmware, All Available, I can see several previous versions of FortiOS (image attached). I have the option to choose any of these versions, select Confirm Version Downgrade and click on Backup Config and Downgrade.

Is this a viable (and indeed advisable) way to go about downgrading our appliances? Apparently it may "result in the loss of some configuration". Can anyone be specific about what this may be?

Many thanks,

 

John P

I would be on 5.2.4 if I thought it was stable. 5.2.3 has major bugs that affect me. If you got to 5.2.4 without major issues, I would consider staying on 5.2.4 either permanently or at least for a while. If everyone avoids 5.2.4 and does just submit support tickets, then 5.2.5 might not get much better than 5.2.4.

regarding downgrades, the process is fairly predictable. backup config, upload firmware, restore config. If you have a pre-upgrade config made on the older firmware version and you have not made many changes, then you can use that previous backup. If you read the downgrade section of most release notes it will mention how most of your config will be lost after a downgrade. don't freak out. This is normal. It will still keep enough config for the device to be reachable for admin login so that you can do the config restore.